CN113139598A - Intrusion detection method and system based on improved intelligent optimization algorithm - Google Patents

Abstract

The invention discloses an intrusion detection method based on an improved intelligent optimization algorithm, which comprises the following steps: acquiring a data set, and carrying out standardization processing on the data set by using a z-score method to obtain a standardized data set; optimizing a penalty coefficient C and a kernel coefficient gamma of the kernel-limit learning machine model by improving an intelligent optimization algorithm, and obtaining an optimized kernel-limit learning machine model; and training the optimized kernel limit learning machine model to obtain a trained kernel limit learning machine model, and classifying the data set by using the trained kernel limit learning machine to obtain a classification result. The invention can solve the technical problems of low convergence rate, easy trapping in local optimal traps and weak global search capability of the existing intrusion detection method based on single intelligent optimization algorithm; and the technical problems of low algorithm iteration efficiency and poor calculation precision of the existing intrusion detection method based on various intelligent optimization algorithms.

Description

An intrusion detection method and system based on an improved intelligent optimization algorithm

technical field

The invention belongs to the technical field of information security, and more particularly, relates to an intrusion detection method and system based on an improved intelligent optimization algorithm.

Background technique

With the gradual improvement of the degree of network informatization, network malicious attacks are becoming more and more frequent, and network security issues have attracted extensive attention from researchers all over the world. As the second security protection strategy behind the firewall, the intrusion detection method is a flexible and effective active defense method. It can monitor abnormal conditions in the system in real time. When malicious attacks or illegal operations on computer equipment are found in the system , can send out alarm information in time, is an effective supplement to the firewall.

In recent years, kernel extreme learning machines have been widely used in intrusion detection methods because of their simple structure, fewer iterations and faster running speed. However, if the parameters in the kernel extreme learning machine are not properly selected, the classification effect of the kernel extreme learning machine will be greatly reduced. The intelligent optimization algorithm solves the optimization problem by simulating natural phenomena or biological behavior, and is a better optimization method.

The current mainstream intelligent optimization algorithms mainly include: 1. Intrusion detection methods based on a single intelligent optimization algorithm, the optimization method usually adopts a single intelligent optimization method to optimize the parameters in the kernel extreme learning machine, such as differential evolution method, artificial bee colony Algorithms and tabu search algorithms, etc.; 2. Intrusion detection methods based on multiple intelligent optimization algorithms. The optimization methods usually combine multiple intelligent optimization algorithms for optimization work.

However, the above-mentioned existing intelligent optimization algorithms all have some shortcomings that cannot be ignored: First, for intrusion detection methods based on a single intelligent optimization algorithm, the optimization methods often have slow convergence speed, easy to fall into the trap of local optimality and global search. Second, for intrusion detection methods based on multiple intelligent optimization algorithms, the optimization methods usually only combine standard intelligent optimization algorithms, and cannot effectively solve the problems of low algorithm iteration efficiency and poor calculation accuracy; Third, for intrusion detection methods based on multiple intelligent optimization algorithms, the initial population in the optimization method is often generated by random methods, and there are usually problems such as poor population distribution quality and poor convergence rate.

SUMMARY OF THE INVENTION

In view of the above defects or improvement requirements of the prior art, the present invention provides an intrusion detection method and system based on an improved intelligent optimization algorithm, the purpose of which is to solve the convergence speed of the existing intrusion detection method based on a single intelligent optimization algorithm. It is slow, easy to fall into the local optimal trap, and the technical problems of the global search ability are not strong; and the existing intrusion detection methods based on a variety of intelligent optimization algorithms have the technical problems of low algorithm iteration efficiency, poor calculation accuracy, and the quality of population distribution. Poor technical problems with poor convergence rate.

In order to achieve the above object, according to one aspect of the present invention, an intrusion detection method based on an improved intelligent optimization algorithm is provided, comprising the following steps:

(1) Obtain a data set, and use the z-score method to standardize the data set to obtain a standardized data set;

(2) Optimize the penalty coefficient C and the kernel coefficient γ of the kernel extreme learning machine model by improving the intelligent optimization algorithm, and obtain the optimized kernel extreme learning machine model;

(3) Train the kernel extreme learning machine model optimized in step (2) to obtain a trained kernel extreme learning machine model, and use the trained kernel extreme learning machine to classify the data set to obtain a classification result.

Preferably, step (1) includes the following substeps:

(1-1) Obtain the dataset Ds;

为Ds中第i行第j个样本点，其表示数据集Ds中第i个样本中的第j个特征属性值，且有i∈[1，k]，j∈[1，n]；Among them, k is the total number of samples in the data set Ds, n is the feature dimension of the samples in the data set,

is the jth sample point in the ith row in Ds, which represents the jth feature attribute value in the ith sample in the data set Ds, and has i∈[1,k], j∈[1,n];

并对其进行标准化处理，以得到标准化后的特征属性值

(1-2) Obtain the jth element of the i-th row from the data set Ds obtained in step (1-1)

And normalize it to get the normalized feature attribute value

(1-3) For the remaining sample points in the data set Ds, repeat the above step (1-2) until all the sample points in the data set Ds have been processed, thereby obtaining the standardized data set Ds.

Preferably, the calculation formula of the standardized processing in step (1-2) is as follows:

where μj is the mean of the _jth column in the dataset Ds, and σj is the standard deviation of the _jth column in the dataset Ds.

Preferably, step (2) specifically includes the following substeps:

(2-1) Randomly generate an initial population pop={p ₁ ,p ₂ ,...,p _N } with a population size of N, and set the counter cnt=1, where the mth individual in the population is p _m ={C _m ,γ _m }, m∈[1,N], C _m and γ _m represent the penalty coefficient and kernel coefficient of the mth individual, respectively;

(2-2) Judging whether cnt is greater than the population size N, if so, go to step (2-4), otherwise go to step (2-3);

(2-3) Determine whether cnt is 1. If so, randomly generate a chaotic number α(1) that is in the range of (0,1) and cannot be equal to 0.25, 0.5 and 0.75, and set the counter cnt=cnt+1, And return to step (2-2), otherwise generate the cnt th chaotic number α(cnt), set the counter cnt=cnt+1, and return to step (2-2);

(2-4) Set the counter cnt1=1;

(2-5) Judging whether cnt1 is greater than the population size N, if so, go to step (2-7), otherwise go to step (2-6);

设置计数器cnt1＝cnt1+1，并返回步骤(2-5)；(2-6) Generate the cnt1 chaotic individual

Set the counter cnt1=cnt1+1, and return to step (2-5);

并取新的适应度值集合中前N个个体作为混沌初始化后的种群，取新的适应度值集合中最小适应度值对应的个体作为全局最优解p_best，并设置计数器cnt2＝1，其中sn为适应度值集合F中适应度值的总数；(2-7) Mix the generated N chaotic individuals with the initial population generated in step (2-1) to obtain a mixed population mixpop={mix ₁ , mix ₂ ,..., mix _2N }, and obtain the The fitness value set F={f(mix ₁ ),f(mix ₂ ),...,f(mix _sn )} formed by the fitness values of all individuals, in this fitness value set in the order from small to large to sort all fitness values of , to obtain a new set of fitness values

And take the first N individuals in the new fitness value set as the population after chaotic initialization, take the individual corresponding to the minimum fitness value in the new fitness value set as the global optimal solution p _best , and set the counter cnt2=1, where sn is the total number of fitness values in the fitness value set F;

(2-8) Judging whether cnt2 is equal to the maximum number of iterations T, if so, output the global optimal solution p _best ={C _best ,γ _best }, the process ends, otherwise go to step (2-9);

(2-9) Determine whether cnt2 is 1, if so, take the chaotically initialized population obtained in step (2-7) as the population pop _mix , and randomly select q population individuals from the population pop _mix to form the population pop _de , the remaining population individuals form population pop _abc , and then go to step (2-10), otherwise go to step (2-33);

取该适应度值集合中适应度最小的个体作为改进差分进化算法中的局部最优解

并设置计数器cnt3＝1；(2-10) For the population pop _de obtained in step (2-9), obtain a fitness value set composed of fitness values of all individuals in the population

Take the individual with the smallest fitness in the fitness value set as the local optimal solution in the improved differential evolution algorithm

And set the counter cnt3=1;

和种群pop_de，并转入步骤(2-18)，否则转入步骤(2-12)；(2-11) Determine whether cnt3 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved differential evolution algorithm

and population pop _de , and go to step (2-18), otherwise go to step (2-12);

(2-12) Determine whether cnt3 is 1, and if so, obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de obtained in step (2-10), and go to step (2) -13), otherwise go to step (2-17);

取

中最小适应度值对应的个体作为改进差分进化算法中的局部最优解

并取适应度值排前一半的种群个体组成集合

该适应度值集合

中剩余的个体组成集合

(2-13) For the fitness value set F _de obtained in step (2-12), sort all fitness values in the fitness value set according to the order from small to large to obtain a new fitness value set

Pick

The individual corresponding to the minimum fitness value is used as the local optimal solution in the improved differential evolution algorithm

And take the top half of the population individuals with fitness value to form a set

The fitness value set

The remaining individuals form the set

个个体

生成自适应变异个体

其中

(2-14) According to the first in the set F _de obtained in step (2-13)

individual

Generate adaptive mutant individuals

in

和步骤(2-13)中得到的集合F_de中的第

个个体

行交叉操作，以生成实验个体

(2-15) For the adaptive mutant individual obtained in step (2-14)

and the first in the set F _de obtained in step (2-13)

individual

Crossover operation to generate experimental individuals

对应的适应度值以及步骤(2-13)得到的个体

对应的适应度值，使用二者中较小的适应度值所对应的个体代替适应度值集合F_de中的对应个体，从而得到更新后的种群pop_de，设置计数器cnt3＝cnt3+1，并返回步骤(2-11)；(2-16) Obtain the experimental individuals obtained in the step (2-15)

The corresponding fitness value and the individual obtained in step (2-13)

For the corresponding fitness value, use the individual corresponding to the smaller fitness value of the two to replace the corresponding individual in the fitness value set F _de , so as to obtain the updated population pop _de , set the counter cnt3=cnt3+1, and Return to step (2-11);

(2-17) Obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de updated in step (2-16), and then return to step (2-13);

其中N-q为人工蜂群适应度值集合Fit_abc中人工蜂群适应度值的总数，初始化禁忌表T1为种群pop_abc，禁忌表T2为空，并取人工蜂群适应度值集合Fit_abc中人工蜂群适应度最小的个体作为改进人工蜂群算法中的局部最优解

并设置计数器cnt4＝1；(2-18) For the population pop _abc in step (2-9), obtain an artificial bee colony fitness value set composed of the artificial bee colony fitness values of all individuals in the population

Among them, Nq is the total number of artificial bee colony fitness values in the artificial bee colony fitness value set Fit _abc , the initial taboo table T1 is the population pop _abc , the taboo table T2 is empty, and the artificial bee colony fitness value set Fit _abc is taken from the artificial bee colony fitness value set Fit abc. Individuals with the smallest swarm fitness as a local optimal solution in an improved artificial bee colony algorithm

And set the counter cnt4=1;

和种群pop_abc，转入步骤(2-32)，否则转入步骤(2-20)；(2-19) Determine whether cnt4 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved artificial bee colony algorithm

and population pop _abc , go to step (2-32), otherwise go to step (2-20);

(2-20) Determine whether cnt4 is 1, and if so, obtain the artificial bee colony fitness value set Fit _abc composed of the artificial bee colony fitness values of all individuals in the population pop _abc in step (2-18), Go to step (2-21), otherwise go to step (2-31);

个蜜源个体

生成领域蜜源个体

其中

(2-21) According to the No. 1 in the set Fit _abc obtained in step (2-20)

nectar source

Generate Domain Nectar Individuals

in

判断该领域蜜源个体是否在禁忌表T1或者T2中，如果是则进入步骤(2-21)，否则，将该领域蜜源个体加入禁忌表T1中，并进入步骤(2-23)；(2-22) According to the field nectar source individuals obtained in step (2-21)

Determine whether the nectar source individuals in this field are in the taboo table T1 or T2, if so, go to step (2-21), otherwise, add the nectar source individuals in this field to the taboo table T1, and enter step (2-23);

对应的人工蜂群适应度值

以及领域蜜源个体

对应的人工蜂群适应度值

判断

是否小于

如果是，领域蜜源个体代替原种群的蜜源个体，否则将未更新蜜源表Tr中对应蜜源个体的未更新次数加1；(2-23) Obtain the nectar source individuals of step (2-21)

Corresponding artificial bee colony fitness value

and domain nectar individuals

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1;

个蜜源个体的概率

并产生一个[0,1]范围的随机数，判断该随机数是否小于

如果是，则进入步骤(2-25)，否则，进入步骤(2-28)；(2-24) Calculate the No. 1 nectar population in the updated nectar population obtained in step (2-23)

The probability of a nectar source

And generate a random number in the range of [0,1] to determine whether the random number is less than

If yes, then go to step (2-25), otherwise, go to step (2-28);

生成领域蜜源个体

其中

(2-25) The nectar source individual obtained according to step (2-24)

Generate Domain Nectar Individuals

in

判断该领域蜜源个体是否在禁忌表T1或者T2中，如果是则进入步骤(2-25)，否则，将该领域蜜源个体加入禁忌表T1中，并进入步骤(2-27)；(2-26) According to the field nectar source individual obtained in step (2-25)

Determine whether the nectar source individual in this field is in the taboo table T1 or T2, if so, go to step (2-25), otherwise, add the nectar source individual in this field to the taboo table T1, and enter step (2-27);

对应的人工蜂群适应度值

以及步骤(2-25)的领域蜜源个体

对应的人工蜂群适应度值

判断

是否小于

如果是，领域蜜源个体代替原种群的蜜源个体，否则将未更新蜜源表Tr中对应蜜源个体的未更新次数加1；(2-27) Obtain the nectar source individuals of step (2-24)

Corresponding artificial bee colony fitness value

And the domain nectar individual of step (2-25)

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1;

(2-28) Obtain the maximum number of unupdated times max of Tr in step (2-27), and determine whether max is greater than the maximum search times limit of the nectar source. If so, add the nectar source individual corresponding to max to T2, and go to step ( 2-29), otherwise go to step (2-31);

(2-29) Randomly generate a new nectar source;

(2-30) Determine whether the nectar source individual in step (2-29) is in the taboo table T1 or T2, if so, go to step (2-29), otherwise, add the nectar source individual to the taboo table T1, and obtain The updated population pop _abc , and go to step (2-31), set the counter cnt4=cnt4+1, and return to step (2-19);

(2-31) Obtain the fitness value set Fit _abc formed by the fitness values of all individuals in the population pop _abc updated in step (2-30), and then return to step (2-20);

对应的适应度值

以及步骤(2-19)的局部最优解

对应的适应度值

使用二者中较小的适应度值对应的个体来代替p_best，并将pop_de和pop_abc融合得到更新后的种群pop_mix，设置计数器cnt2＝cnt2+1，并返回步骤(2-8)；(2-32) Obtain the local optimal solution of step (2-11)

The corresponding fitness value

and the local optimal solution of step (2-19)

The corresponding fitness value

Use the individual corresponding to the smaller fitness value of the two to replace p _best , and fuse pop _de and pop _abc to obtain the updated population pop _mix , set the counter cnt2=cnt2+1, and return to step (2-8) ;

(2-33) Obtain the updated population pop _mix in step (2-32), randomly select q population individuals to form population pop _de , and the remaining population individuals form population pop _abc , and then return to step (2-10).

Preferably, the calculation formula for generating the chaotic number in step (2-3) is as follows:

α(cnt)=μ·α(cnt)·(1-α(cnt-1))

Among them, μ is the correlation coefficient, and its value ranges from 0 to 4, preferably 4.

的计算公式如下：Generate the cnt1 chaotic individual in step (2-6)

The calculation formula is as follows:

Among them, p _cnt1 is the cnt1-th initial population individual, and α(cnt1) is the cnt1-th chaotic number.

Step (2-7) is to randomly select the CN group training data from the data set in step (1), and calculate its classification error rate CE as the fitness function f, wherein the calculation formula of the classification error rate CE is as follows:

Among them, EN is the number of misclassified samples, and CN is the number of training data samples.

Preferably, the calculation formula for generating the adaptive mutation individual in step (2-14) is as follows:

两者彼此不相同，且两者均不等于

F_c为自适应变异因子；in,

Both are not identical to each other, and neither is equal to

F _c is the adaptive variation factor;

The formula for calculating the adaptive variation factor F _c is as follows:

where f _c is the initial variation factor;

The calculation formula for generating experimental individuals in step (2-15) is as follows:

Among them, randn is a random integer randomly generated between [1, D], rand is a random real number belonging to a uniform distribution between [0, 1], CR is the crossover factor, D is the individual gene dimension, where h∈[ 1, D];

The artificial bee colony fitness function in step (2-18) adopts the following formula:

where f is the fitness function and abs is the absolute value function.

Preferably, in step (2-21), the calculation formula for generating domain nectar source individuals is as follows:

且与

不相同，φ为邻域搜索因子，是-1到1的一个随机数。in

and with

Not the same, φ is the neighborhood search factor, which is a random number from -1 to 1.

The calculation formula of the generation probability in step (2-24) is as follows:

Preferably, step (3) specifically includes the following substeps:

(3-1) Divide the standardized data set in step (1) into a training set and a test set according to a ratio of 7:3;

(3-2) Obtain the Gaussian kernel function K(x _ki , x _kj ) according to the optimal kernel parameter γ _best obtained in step (2), and according to the Gaussian kernel function K(x _ki , x _kj ) and step (3- The training set obtained in 1) obtains a trained kernel extreme learning machine model;

(3-3) Use the kernel extreme learning machine model trained in step (3-2) to classify the test set in step (3-1) to obtain a classification result.

Preferably, in step (3-2), the process of using the optimal kernel parameter γ _best to obtain the Gaussian kernel function K(x _ki , x _kj ) is as follows:

K(x _ki ,x _kj )=exp(-||x _ki -x _kj || ² /γ _best )

The training formula of the kernel extreme learning machine model is as follows:

where f(x) is the output function of the kernel extreme learning machine, KN is the total number of training sets, Ω _KELM is the kernel matrix corresponding to the Gaussian kernel function, T is the label of the training set, and C _best is obtained according to step (2) optimal penalty coefficient.

According to another aspect of the present invention, an intrusion detection system based on an improved intelligent optimization algorithm is provided, comprising:

The first module is used to obtain the data set, and use the z-score method to standardize the data set to obtain the standardized data set;

The second module is used to optimize the penalty coefficient C and the kernel coefficient γ of the kernel extreme learning machine model by improving the intelligent optimization algorithm, and obtain the optimized kernel extreme learning machine model;

The third module is used to train the kernel extreme learning machine model optimized by the second module to obtain the trained kernel extreme learning machine model, and use the trained kernel extreme learning machine to classify the data set to obtain the classification result.

In general, compared with the prior art, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

(1) Since the present invention adopts steps (2-1) to (2-7), it adopts the chaotic initialization strategy to initialize the population, so it can solve the problem of population quality distribution in the existing intrusion detection methods based on multiple intelligent optimization algorithms Technical problems that are poor and cannot obtain high-quality optimal solutions;

(2) Since the present invention adopts steps (2-14) and (2-18), it introduces adaptive mutation factor and elite evolution strategy to improve the differential evolution algorithm, and at the same time adopts the tabu search algorithm to perform artificial bee colony algorithm. Therefore, the existing intrusion detection methods based on a single intelligent optimization algorithm can solve the technical problems of slow convergence speed, low calculation accuracy, easy to fall into the trap of local optimum and weak global search ability;

(3) Since the present invention adopts step (2-32), it adopts the improved differential evolution algorithm and the improved artificial bee colony algorithm as the basic optimization algorithm to combine, so it can solve the existing intrusion based on a variety of intelligent optimization algorithms. Technical issues with low operational efficiency and poor algorithm performance in detection methods.

Description of drawings

Fig. 1 is a flow chart of the intrusion detection method based on the improved intelligent optimization algorithm of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

The basic idea of the present invention is to propose an intrusion detection method based on an improved intelligent optimization algorithm. The method firstly aims at the problem that the differential evolution algorithm is prone to fall into the local optimum trap, and introduces an adaptive mutation factor to make the differential evolution algorithm jump out of the local optimum. The figure of merit is improved, and the global search ability of the differential evolution algorithm is improved. At the same time, the elite evolution strategy is used to improve the search rate of the differential evolution algorithm and accelerate the convergence speed of the algorithm. Then, in view of the problem that artificial bee colony algorithm is prone to fall into premature and poor global search ability, the excellent global search ability of tabu search algorithm is used to optimize the domain search ability in artificial bee colony algorithm, and at the same time improve the operation efficiency of artificial bee colony algorithm. Finally, the above two improved algorithms are combined as the basic optimization algorithm, and the chaotic initialization strategy is introduced to initialize the population, and an improved intelligent optimization algorithm is obtained, and the improved intelligent optimization algorithm is applied to the parameter optimization of the intrusion detection method. The classification accuracy and stability of the intrusion detection method are improved. Compared with other intrusion detection algorithms based on intelligent optimization algorithms, this method is easy to jump out of the local optimum, and can effectively avoid the premature algorithm.

As shown in Figure 1, the present invention provides an intrusion detection method based on an improved intelligent optimization algorithm, comprising the following steps:

(1) Obtain a data set, and use the z-score method to standardize the data set to obtain a standardized data set;

This step specifically includes the following sub-steps:

(1-1) Obtain the dataset Ds;

为Ds中第i行第j个样本点，其表示数据集Ds中第i个样本中的第j个特征属性值，且有i∈[1，k]，j∈[1，n]；Among them, k is the total number of samples in the data set Ds, n is the feature dimension of the samples in the data set,

is the jth sample point in the ith row in Ds, which represents the jth feature attribute value in the ith sample in the data set Ds, and has i∈[1,k], j∈[1,n];

并对其进行标准化处理，以得到标准化后的特征属性值

(1-2) Obtain the j-th element of the i-th row (that is, the j-th feature attribute value in the i-th sample) from the data set Ds obtained in step (1-1)

And normalize it to get the normalized feature attribute value

The calculation formula of the above normalization processing is as follows:

Among them, μ _j is the mean of the jth column in the data set Ds, and σ _j is the standard deviation of the jth column in the data set Ds;

(1-3) For the remaining sample points in the data set Ds, repeat the above step (1-2) until all the sample points in the data set Ds have been processed, thereby obtaining the standardized data set Ds;

(2) Optimize the penalty coefficient C and the kernel coefficient γ of the kernel extreme learning machine model by improving the intelligent optimization algorithm, and obtain the optimized kernel extreme learning machine model;

This step specifically includes the following sub-steps:

(2-1) Randomly generate an initial population pop={p ₁ ,p ₂ ,...,p _N } with a population size of N, and set the counter cnt=1, where the mth individual in the population is p _m ={C _m ,γ _m }, m∈[1,N], C _m and γ _m represent the penalty coefficient and kernel coefficient of the mth individual, respectively;

Specifically, the population size N ranges from 10 to 60, preferably 20.

(2-2) Judging whether cnt is greater than the population size N, if so, go to step (2-4), otherwise go to step (2-3);

(2-3) Determine whether cnt is 1. If so, randomly generate a chaotic number α(1) that is in the range of (0,1) and cannot be equal to 0.25, 0.5 and 0.75, and set the counter cnt=cnt+1, And return to step (2-2), otherwise generate the cnt th chaotic number α(cnt), set the counter cnt=cnt+1, and return to step (2-2);

The calculation formula of the above generated chaotic number is as follows:

α(cnt)=μ·α(cnt)·(1-α(cnt-1))

Among them, μ is the correlation coefficient, and its value ranges from 0 to 4, preferably 4.

(2-4) Set the counter cnt1=1;

(2-5) Judging whether cnt1 is greater than the population size N, if so, go to step (2-7), otherwise go to step (2-6);

设置计数器cnt1＝cnt1+1，并返回步骤(2-5)；(2-6) Generate the cnt1 chaotic individual

Set the counter cnt1=cnt1+1, and return to step (2-5);

的计算公式如下：The above generates the cnt1th chaotic individual

The calculation formula is as follows:

Among them, p _cnt1 is the cnt1-th initial population individual, and α(cnt1) is the cnt1-th chaotic number.

并取新的适应度值集合中前N个个体作为混沌初始化后的种群，取新的适应度值集合中最小适应度值对应的个体作为全局最优解p_best，并设置计数器cnt2＝1，其中sn为适应度值集合F中适应度值的总数；(2-7) Mix the generated N chaotic individuals with the initial population generated in step (2-1) to obtain a mixed population mixpop={mix ₁ , mix ₂ ,..., mix _2N }, and obtain the The fitness value set F={f(mix ₁ ),f(mix ₂ ),...,f(mix _sn )} formed by the fitness values of all individuals, in this fitness value set in the order from small to large to sort all fitness values of , to obtain a new set of fitness values

And take the first N individuals in the new fitness value set as the population after chaotic initialization, take the individual corresponding to the minimum fitness value in the new fitness value set as the global optimal solution p _best , and set the counter cnt2=1, where sn is the total number of fitness values in the fitness value set F;

Specifically, in this step, the CN group training data is randomly selected from the data set in step (1), and its classification error rate CE is calculated as the fitness function f.

Specifically, the calculation formula of the classification error rate CE is as follows:

Among them, EN is the number of misclassified samples, CN is the number of training data samples, and its value ranges from 100 to 500, preferably 400.

The advantages of the above steps (2-1) to (2-7) are that the chaotic map is used to generate the chaotic number, and then the chaotic population is generated, and the individual with better quality in the chaotic population and the initial population is taken as the initialization individual, so the solution The existing intrusion detection methods based on a variety of intelligent optimization algorithms have the technical problems that the population quality distribution is poor and the optimal solution with high quality cannot be obtained.

(2-8) Judging whether cnt2 is equal to the maximum number of iterations T, if so, output the global optimal solution p _best ={C _best ,γ _best }, the process ends, otherwise go to step (2-9);

Specifically, the value range of the maximum number of iterations T is 500 to 1000, preferably 500.

(2-9) Determine whether cnt2 is 1, if so, take the chaotically initialized population obtained in step (2-7) as the population pop _mix , and randomly select q population individuals from the population pop _mix to form the population pop _de , the remaining population individuals form population pop _abc , and then go to step (2-10), otherwise go to step (2-33);

In this step, the value range of q is 0 to 20.

取该适应度值集合中适应度最小的个体作为改进差分进化算法中的局部最优解

并设置计数器cnt3＝1；(2-10) For the population pop _de obtained in step (2-9), obtain a fitness value set composed of fitness values of all individuals in the population

Take the individual with the smallest fitness in the fitness value set as the local optimal solution in the improved differential evolution algorithm

And set the counter cnt3=1;

和种群pop_de，并转入步骤(2-18)，否则转入步骤(2-12)；(2-11) Determine whether cnt3 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved differential evolution algorithm

and population pop _de , and go to step (2-18), otherwise go to step (2-12);

Specifically, the maximum subpopulation iteration number I ranges from 5 to 10, preferably 10.

(2-12) Determine whether cnt3 is 1, and if so, obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de obtained in step (2-10), and go to step (2) -13), otherwise go to step (2-17);

取

中最小适应度值对应的个体作为改进差分进化算法中的局部最优解

并取适应度值排前一半的种群个体组成集合

该适应度值集合

中剩余的个体组成集合

(2-13) For the fitness value set F _de obtained in step (2-12), sort all fitness values in the fitness value set according to the order from small to large to obtain a new fitness value set

Pick

The individual corresponding to the minimum fitness value is used as the local optimal solution in the improved differential evolution algorithm

And take the top half of the population individuals with fitness value to form a set

The fitness value set

The remaining individuals form the set

个个体

生成自适应变异个体

其中

(2-14) According to the first in the set F _de obtained in step (2-13)

individual

Generate adaptive mutant individuals

in

Specifically, the calculation formula for generating adaptive mutant individuals is as follows:

两者彼此不相同，且两者均不等于

F_c为自适应变异因子。in,

Both are not identical to each other, and neither is equal to

F _c is the adaptive variation factor.

The formula for calculating the adaptive variation factor F _c is as follows:

Among them, f _c is the initial variation factor, and its value ranges from 0.5 to 0.8, preferably 0.5.

The advantage of the above steps (2-14) is that the adaptive variation factor is used to dynamically change the variation factor. In the early stage of the iteration, a larger adaptive variation factor is used to generate more disturbance variables to improve the individual diversity of the population. At the same time, in the later stage of the iteration, a smaller adaptive mutation factor is used to reduce the probability of the optimal individual of the differential evolution algorithm being destroyed, so as to improve the convergence speed of the algorithm. Then, the elite individual information is obtained through the elite evolution strategy to improve the operation of the algorithm. Therefore, it can solve the technical problems of slow convergence speed and low calculation accuracy in the existing intrusion detection methods based on differential evolution algorithm.

和步骤(2-13)中得到的集合F_de中的第

个个体

行交叉操作，以生成实验个体

(2-15) For the adaptive mutant individual obtained in step (2-14)

and the first in the set F _de obtained in step (2-13)

individual

Crossover operation to generate experimental individuals

Specifically, the calculation formula for generating experimental individuals is as follows:

Among them, randn is a random integer randomly generated between [1, D], rand is a random real number belonging to a uniform distribution between [0, 1], CR is the crossover factor, D is the individual gene dimension, where h∈[ 1, D];

Specifically, the value range of the cross factor CR is 0.1 to 0.9, preferably 0.3, and the value range of the individual gene dimension D is 1 to 10, preferably 2.

对应的适应度值以及步骤(2-13)得到的个体

对应的适应度值，使用二者中较小的适应度值所对应的个体代替适应度值集合F_de中的对应个体，从而得到更新后的种群pop_de，设置计数器cnt3＝cnt3+1，并返回步骤(2-11)；(2-16) Obtain the experimental individuals obtained in the step (2-15)

The corresponding fitness value and the individual obtained in step (2-13)

For the corresponding fitness value, use the individual corresponding to the smaller fitness value of the two to replace the corresponding individual in the fitness value set F _de , so as to obtain the updated population pop _de , set the counter cnt3=cnt3+1, and Return to step (2-11);

(2-17) Obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de updated in step (2-16), and then return to step (2-13);

其中N-q为人工蜂群适应度值集合Fit_abc中人工蜂群适应度值的总数，初始化禁忌表T1为种群pop_abc，禁忌表T2为空，并取人工蜂群适应度值集合Fit_abc中人工蜂群适应度最小的个体作为改进人工蜂群算法中的局部最优解

并设置计数器cnt4＝1；(2-18) For the population pop _abc in step (2-9), obtain an artificial bee colony fitness value set composed of the artificial bee colony fitness values of all individuals in the population

Among them, Nq is the total number of artificial bee colony fitness values in the artificial bee colony fitness value set Fit _abc , the initial taboo table T1 is the population pop _abc , the taboo table T2 is empty, and the artificial bee colony fitness value set Fit _abc is taken from the artificial bee colony fitness value set Fit abc. Individuals with the smallest swarm fitness as a local optimal solution in an improved artificial bee colony algorithm

And set the counter cnt4=1;

Specifically, the artificial bee colony fitness function in this step adopts the following formula:

where f is the fitness function and abs is the absolute value function.

The advantage of the above steps (2-18) is that the tabu table is used to store the solutions that have been searched in the artificial bee colony, and the solutions that have been stored in the tabu table are no longer searched in the subsequent iteration process, which effectively avoids the iterative process. The repeated search in the algorithm can prevent the algorithm from falling into the local optimal trap, so it can solve the technical problems that the existing intrusion detection methods based on the artificial bee colony algorithm are easy to fall into the local optimal trap and the global search ability is not strong.

和种群pop_abc，转入步骤(2-32)，否则转入步骤(2-20)；(2-19) Determine whether cnt4 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved artificial bee colony algorithm

and population pop _abc , go to step (2-32), otherwise go to step (2-20);

(2-20) Determine whether cnt4 is 1, and if so, obtain the artificial bee colony fitness value set Fit _abc composed of the artificial bee colony fitness values of all individuals in the population pop _abc in step (2-18), Go to step (2-21), otherwise go to step (2-31);

个蜜源个体

生成领域蜜源个体

其中

(2-21) According to the No. 1 in the set Fit _abc obtained in step (2-20)

nectar source

Generate Domain Nectar Individuals

in

The calculation formula for generating the nectar source individuals in the field is as follows:

且与

不相同，φ为邻域搜索因子，是-1到1的一个随机数。in

and with

Not the same, φ is the neighborhood search factor, which is a random number from -1 to 1.

判断该领域蜜源个体是否在禁忌表T1或者T2中，如果是则进入步骤(2-21)，否则，将该领域蜜源个体加入禁忌表T1中，并进入步骤(2-23)；(2-22) According to the field nectar source individuals obtained in step (2-21)

Determine whether the nectar source individuals in this field are in the taboo table T1 or T2, if so, go to step (2-21), otherwise, add the nectar source individuals in this field to the taboo table T1, and enter step (2-23);

对应的人工蜂群适应度值

以及领域蜜源个体

对应的人工蜂群适应度值

判断

是否小于

如果是，领域蜜源个体代替原种群的蜜源个体，否则将未更新蜜源表Tr中对应蜜源个体的未更新次数加1；(2-23) Obtain the nectar source individuals of step (2-21)

Corresponding artificial bee colony fitness value

and domain nectar individuals

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1;

个蜜源个体的概率

并产生一个[0,1]范围的随机数，判断该随机数是否小于

如果是，则进入步骤(2-25)，否则，进入步骤(2-28)；(2-24) Calculate the No. 1 nectar population in the updated nectar population obtained in step (2-23)

The probability of a nectar source

And generate a random number in the range of [0,1] to determine whether the random number is less than

If yes, then go to step (2-25), otherwise, go to step (2-28);

The calculation formula of the generation probability is as follows:

生成领域蜜源个体

其中

(2-25) The nectar source individual obtained according to step (2-24)

Generate Domain Nectar Individuals

in

判断该领域蜜源个体是否在禁忌表T1或者T2中，如果是则进入步骤(2-25)，否则，将该领域蜜源个体加入禁忌表T1中，并进入步骤(2-27)；(2-26) According to the field nectar source individual obtained in step (2-25)

Determine whether the nectar source individual in this field is in the taboo table T1 or T2, if so, go to step (2-25), otherwise, add the nectar source individual in this field to the taboo table T1, and enter step (2-27);

对应的人工蜂群适应度值

以及步骤(2-25)的领域蜜源个体

对应的人工蜂群适应度值

判断

是否小于

如果是，领域蜜源个体代替原种群的蜜源个体，否则将未更新蜜源表Tr中对应蜜源个体的未更新次数加1；(2-27) Obtain the nectar source individuals of step (2-24)

Corresponding artificial bee colony fitness value

And the domain nectar individual of step (2-25)

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1;

(2-28) Obtain the maximum number of unupdated times max of Tr in step (2-27), and determine whether max is greater than the maximum search times limit of the nectar source. If so, add the nectar source individual corresponding to max to T2, and go to step ( 2-29), otherwise go to step (2-31);

Specifically, the value range of the maximum search times limit of the nectar source is 5 to 100, preferably 50.

(2-29) Randomly generate a new nectar source;

(2-30) Determine whether the nectar source individual in step (2-29) is in the taboo table T1 or T2, if so, go to step (2-29), otherwise, add the nectar source individual to the taboo table T1, and obtain The updated population pop _abc , and go to step (2-31), set the counter cnt4=cnt4+1, and return to step (2-19);

(2-31) Obtain the fitness value set Fit _abc formed by the fitness values of all individuals in the population pop _abc updated in step (2-30), and then return to step (2-20);

对应的适应度值

以及步骤(2-19)的局部最优解

对应的适应度值

使用二者中较小的适应度值对应的个体来代替p_best，并将pop_de和pop_abc融合得到更新后的种群pop_mix，设置计数器cnt2＝cnt2+1，并返回步骤(2-8)；(2-32) Obtain the local optimal solution of step (2-11)

The corresponding fitness value

and the local optimal solution of step (2-19)

The corresponding fitness value

Use the individual corresponding to the smaller fitness value of the two to replace p _best , and fuse pop _de and pop _abc to obtain the updated population pop _mix , set the counter cnt2=cnt2+1, and return to step (2-8) ;

The advantage of the above steps (2-32) is that the improved differential evolution algorithm and the improved artificial bee colony algorithm are integrated as the basic optimization algorithm, so it can solve the problem of running in the existing intrusion detection methods based on multiple intelligent optimization algorithms. Technical issues with lower efficiency and poor algorithm performance.

(2-33) Obtain the updated population pop _mix in step (2-32), and randomly select q population individuals to form population pop _de , and the remaining population individuals form population pop _abc , and then return to step (2-10);

(3) training the nuclear extreme learning machine model optimized in step (2) to obtain a trained nuclear extreme learning machine model, and using the trained nuclear extreme learning machine to classify the data set to obtain a classification result;

This step specifically includes the following sub-steps:

(3-1) Divide the standardized data set in step (1) into a training set and a test set according to a ratio of 7:3;

(3-2) Obtain the Gaussian kernel function K(x _ki , x _kj ) according to the optimal kernel parameter γ _best obtained in step (2), and according to the Gaussian kernel function K(x _ki , x _kj ) and step (3- The training set obtained in 1) obtains a trained kernel extreme learning machine model;

In this step, the process of using the optimal kernel parameter γ _best to obtain the Gaussian kernel function K(x _ki , x _kj ) is as follows:

K(x _ki ,x _kj )=exp(-||x _ki -x _kj || ² /γ _best )

The training formula of the kernel extreme learning machine model is as follows:

where f(x) is the output function of the kernel extreme learning machine, KN is the total number of training sets, Ω _KELM is the kernel matrix corresponding to the Gaussian kernel function, T is the label of the training set, and C _best is obtained according to step (2) optimal penalty coefficient.

(3-3) Use the kernel extreme learning machine model trained in step (3-2) to classify the test set in step (3-1) to obtain a classification result.

Those skilled in the art can easily understand that the above are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, etc., All should be included within the protection scope of the present invention.

Claims (10)

1. an intrusion detection method based on improving intelligent optimization algorithm, is characterized in that, comprises the following steps: (1) Obtain a data set, and use the z-score method to standardize the data set to obtain a standardized data set; (2) Optimize the penalty coefficient C and the kernel coefficient γ of the kernel extreme learning machine model by improving the intelligent optimization algorithm, and obtain the optimized kernel extreme learning machine model; (3) Train the kernel extreme learning machine model optimized in step (2) to obtain a trained kernel extreme learning machine model, and use the trained kernel extreme learning machine to classify the data set to obtain a classification result. 2. the intrusion detection method based on improved intelligent optimization algorithm according to claim 1, is characterized in that, step (1) comprises following substep: (1-1) Obtain the dataset Ds;

Among them, k is the total number of samples in the data set Ds, n is the feature dimension of the samples in the data set,

is the jth sample point in the ith row in Ds, which represents the jth feature attribute value in the ith sample in the data set Ds, and has i∈[1,k], j∈[1,n]; (1-2) Obtain the jth element of the i-th row from the data set Ds obtained in step (1-1)

And normalize it to get the normalized feature attribute value

(1-3) For the remaining sample points in the data set Ds, repeat the above step (1-2) until all the sample points in the data set Ds have been processed, thereby obtaining the standardized data set Ds. 3. the intrusion detection method based on improved intelligent optimization algorithm according to claim 1 and 2, is characterized in that, the calculation formula of the standardized processing in step (1-2) is as follows:

where μj is the mean of the _jth column in the dataset Ds, and σj is the standard deviation of the _jth column in the dataset Ds. 4. the intrusion detection method based on the improved intelligent optimization algorithm according to any one of claims 1 to 3, is characterized in that, step (2) specifically comprises the following sub-steps: (2-1) Randomly generate an initial population pop={p ₁ ,p ₂ ,...,p _N } with a population size of N, and set the counter cnt=1, where the mth individual in the population is p _m ={C _m ,γ _m }, m∈[1,N], C _m and γ _m represent the penalty coefficient and kernel coefficient of the mth individual, respectively; (2-2) Judging whether cnt is greater than the population size N, if so, go to step (2-4), otherwise go to step (2-3); (2-3) Determine whether cnt is 1. If so, randomly generate a chaotic number α(1) that is in the range of (0,1) and cannot be equal to 0.25, 0.5 and 0.75, and set the counter cnt=cnt+1, And return to step (2-2), otherwise generate the cnt th chaotic number α(cnt), set the counter cnt=cnt+1, and return to step (2-2); (2-4) Set the counter cnt1=1; (2-5) Judging whether cnt1 is greater than the population size N, if so, go to step (2-7), otherwise go to step (2-6); (2-6) Generate the cnt1 chaotic individual

Set the counter cnt1=cnt1+1, and return to step (2-5); (2-7) Mix the generated N chaotic individuals with the initial population generated in step (2-1) to obtain a mixed population mixpop={mix ₁ , mix ₂ ,..., mix _2N }, and obtain the The fitness value set F={f(mix ₁ ),f(mix ₂ ),...,f(mix _sn )} formed by the fitness values of all individuals, in this fitness value set in the order from small to large to sort all fitness values of , to obtain a new set of fitness values

And take the first N individuals in the new fitness value set as the population after chaotic initialization, take the individual corresponding to the minimum fitness value in the new fitness value set as the global optimal solution p _best , and set the counter cnt2=1, where sn is the total number of fitness values in the fitness value set F; (2-8) Judging whether cnt2 is equal to the maximum number of iterations T, if so, output the global optimal solution p _best ={C _best ,γ _best }, the process ends, otherwise go to step (2-9); (2-9) Determine whether cnt2 is 1, if so, take the chaotically initialized population obtained in step (2-7) as the population pop _mix , and randomly select q population individuals from the population pop _mix to form the population pop _de , the remaining population individuals form population pop _abc , and then go to step (2-10), otherwise go to step (2-33); (2-10) For the population pop _de obtained in step (2-9), obtain a fitness value set composed of fitness values of all individuals in the population

Take the individual with the smallest fitness in the fitness value set as the local optimal solution in the improved differential evolution algorithm

And set the counter cnt3=1; (2-11) Determine whether cnt3 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved differential evolution algorithm

and population pop _de , and go to step (2-18), otherwise go to step (2-12); (2-12) Determine whether cnt3 is 1, and if so, obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de obtained in step (2-10), and go to step (2) -13), otherwise go to step (2-17); (2-13) For the fitness value set F _de obtained in step (2-12), sort all fitness values in the fitness value set according to the order from small to large to obtain a new fitness value set

Pick

The individual corresponding to the minimum fitness value is used as the local optimal solution in the improved differential evolution algorithm

And take the top half of the population individuals with fitness value to form a set

The fitness value set

The remaining individuals in the set form a set

(2-14) According to the first in the set F _de obtained in step (2-13)

individual

Generate adaptive mutant individuals

in

(2-15) For the adaptive mutant individual obtained in step (2-14)

and the first in the set F _de obtained in step (2-13)

individual

Crossover operation to generate experimental individuals

(2-16) Obtain the experimental individuals obtained in the step (2-15)

The corresponding fitness value and the individual obtained in step (2-13)

For the corresponding fitness value, use the individual corresponding to the smaller fitness value of the two to replace the corresponding individual in the fitness value set F _de , so as to obtain the updated population pop _de , set the counter cnt3=cnt3+1, and Return to step (2-11); (2-17) Obtain the fitness value set F _de formed by the fitness values of all individuals in the population pop _de updated in step (2-16), and then return to step (2-13); (2-18) For the population pop _abc in step (2-9), obtain an artificial bee colony fitness value set composed of the artificial bee colony fitness values of all individuals in the population

Among them, Nq is the total number of artificial bee colony fitness values in the artificial bee colony fitness value set Fit _abc , the initial taboo table T1 is the population pop _abc , the taboo table T2 is empty, and the artificial bee colony fitness value set Fit _abc is taken from the artificial bee colony fitness value set Fit abc. Individuals with the smallest swarm fitness as a local optimal solution in an improved artificial bee colony algorithm

And set the counter cnt4=1; (2-19) Determine whether cnt4 is equal to the maximum number of subpopulation iterations I, and if so, save the local optimal solution in the improved artificial bee colony algorithm

and population pop _abc , go to step (2-32), otherwise go to step (2-20); (2-20) Determine whether cnt4 is 1, and if so, obtain the artificial bee colony fitness value set Fit _abc composed of the artificial bee colony fitness values of all individuals in the population pop _abc in step (2-18), Go to step (2-21), otherwise go to step (2-31); (2-21) According to the No. 1 in the set Fit _abc obtained in step (2-20)

nectar source

Generate Domain Nectar Individuals

in

(2-22) According to the field nectar source individuals obtained in step (2-21)

Determine whether the nectar source individuals in this field are in the taboo table T1 or T2, if so, go to step (2-21), otherwise, add the nectar source individuals in this field to the taboo table T1, and enter step (2-23); (2-23) Obtain the nectar source individuals of step (2-21)

Corresponding artificial bee colony fitness value

and domain nectar individuals

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1; (2-24) Calculate the No. 1 nectar population in the updated nectar population obtained in step (2-23)

The probability of a nectar source

And generate a random number in the range of [0,1] to determine whether the random number is less than

If yes, then go to step (2-25), otherwise, go to step (2-28); (2-25) The nectar source individual obtained according to step (2-24)

Generate Domain Nectar Individuals

in

(2-26) According to the field nectar source individual obtained in step (2-25)

Determine whether the nectar source individuals in this field are in the taboo table T1 or T2, if so, go to step (2-25), otherwise, add the nectar source individuals in this field to the taboo table T1, and enter step (2-27); (2-27) Obtain the nectar source individuals of step (2-24)

Corresponding artificial bee colony fitness value

And the domain nectar individual of step (2-25)

Corresponding artificial bee colony fitness value

judge

Is it less than

If yes, the domain nectar source individual replaces the nectar source individual of the original population, otherwise the unupdated number of the corresponding nectar source individual in the unupdated nectar source table Tr is increased by 1; (2-28) Obtain the maximum number of unupdated times max of Tr in step (2-27), and determine whether max is greater than the maximum search times limit of the nectar source. If so, add the nectar source individual corresponding to max to T2, and go to step ( 2-29), otherwise go to step (2-31); (2-29) Randomly generate a new nectar source; (2-30) Determine whether the nectar source individual in step (2-29) is in the taboo table T1 or T2, if so, enter step (2-29), otherwise, add the nectar source individual to the taboo table T1, and obtain The updated population pop _abc , and go to step (2-31), set the counter cnt4=cnt4+1, and return to step (2-19); (2-31) Obtain the fitness value set Fit _abc formed by the fitness values of all individuals in the population pop _abc updated in step (2-30), and then return to step (2-20); (2-32) Obtain the local optimal solution of step (2-11)

The corresponding fitness value

and the local optimal solution of step (2-19)

The corresponding fitness value

Use the individual corresponding to the smaller fitness value of the two to replace p _best , and fuse pop _de and pop _abc to get the updated population pop _mix , set the counter cnt2=cnt2+1, and return to step (2-8) ; (2-33) Obtain the updated population pop _mix in step (2-32), randomly select q population individuals to form population pop _de , and the remaining population individuals form population pop _abc , and then return to step (2-10). 5. the intrusion detection method based on improved intelligent optimization algorithm according to claim 4, is characterized in that, The calculation formula for generating the chaotic number in step (2-3) is as follows: α(cnt)=μ·α(cnt)·(1-α(cnt-1)) Among them, μ is the correlation coefficient, and its value ranges from 0 to 4, preferably 4. Generate the cnt1 chaotic individual in step (2-6)

The calculation formula is as follows:

Among them, p _cnt1 is the cnt1-th initial population individual, and α(cnt1) is the cnt1-th chaotic number. Step (2-7) is to randomly select the CN group training data from the data set in step (1), and calculate its classification error rate CE as the fitness function f, wherein the calculation formula of the classification error rate CE is as follows:

Among them, EN is the number of misclassified samples, and CN is the number of training data samples. 6. the intrusion detection method based on improved intelligent optimization algorithm according to claim 4, is characterized in that, The calculation formula for generating adaptive mutant individuals in step (2-14) is as follows:

in,

Both are not identical to each other, and neither is equal to

F _c is the adaptive variation factor; The formula for calculating the adaptive variation factor F _c is as follows:

where f _c is the initial variation factor; The calculation formula for generating experimental individuals in step (2-15) is as follows:

Among them, randn is a random integer randomly generated between [1, D], rand is a random real number belonging to a uniform distribution between [0, 1], CR is the crossover factor, D is the individual gene dimension, where h∈[ 1, D]; The artificial bee colony fitness function in step (2-18) adopts the following formula:

where f is the fitness function and abs is the absolute value function. 7. the intrusion detection method based on improved intelligent optimization algorithm according to claim 4, is characterized in that, in step (2-21), the calculation formula that generates domain nectar source individual is as follows:

in

and with

Not the same, φ is the neighborhood search factor, which is a random number from -1 to 1. The calculation formula of the generation probability in step (2-24) is as follows:

8. the intrusion detection method based on improved intelligent optimization algorithm according to claim 1, is characterized in that, step (3) specifically comprises following substep: (3-1) Divide the standardized data set in step (1) into a training set and a test set according to a ratio of 7:3; (3-2) Obtain the Gaussian kernel function K(x _ki , x _kj ) according to the optimal kernel parameter γ _best obtained in step (2), and according to the Gaussian kernel function K(x _ki , x _kj ) and step (3- The training set obtained in 1) obtains a trained kernel extreme learning machine model; (3-3) Use the kernel extreme learning machine model trained in step (3-2) to classify the test set in step (3-1) to obtain a classification result. 9. the intrusion detection method based on improved intelligent optimization algorithm according to claim 8, is characterized in that, in step (3-2), use optimal kernel parameter γ _best to obtain Gaussian kernel function K (x _ki , x _kj ) Specifically, this process is: K(x _ki ,x _kj )=exp(-||x _ki -x _kj || ² /γ _best ) The training formula of the kernel extreme learning machine model is as follows:

where f(x) is the output function of the kernel extreme learning machine, KN is the total number of training sets, Ω _KELM is the kernel matrix corresponding to the Gaussian kernel function, T is the label of the training set, and C _best is obtained according to step (2) optimal penalty coefficient. 10. An intrusion detection system based on an improved intelligent optimization algorithm, characterized in that, comprising: The first module is used to obtain the data set, and use the z-score method to standardize the data set to obtain the standardized data set; The second module is used to optimize the penalty coefficient C and the kernel coefficient γ of the kernel extreme learning machine model by improving the intelligent optimization algorithm, and obtain the optimized kernel extreme learning machine model; The third module is used to train the kernel extreme learning machine model optimized by the second module to obtain the trained kernel extreme learning machine model, and use the trained kernel extreme learning machine to classify the data set to obtain the classification result.

Images